firecracker-microvm / firecracker-microvm/firecracker
Investigate running the jailer with reduced set of capabilities
Open
Good first issue
Priority: Low
Status: Parked
Type: Enhancement
- Dominant language
- Rust
- Stars
- 36.7k
- Forks
- 2.6k
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 58
Description
We currently start the `jailer` as the superuser (i.e. using `sudo`), and rely on the fact the process will deprivilege itself before `exec`-ing into Firecracker. It would be interesting to know if we can run the `jailer` using a more restricted set of capabilities instead of full superuser mode.
Contributor guide
Assessment
This issue has not been assessed yet.